TECHNICAL LEAD - SOAR Concept

Job description

**Security Orchestration and Automation** As part of this profile, the resource will perform the following: **Platform Management and Administration** - Manage, administer, and support the SOAR platform **(preferable CrowdStrike Falcon Fusion SOAR, Including** - Master Console - SOAR SME - SOAR Agents - Platform updates, configuration management, and issue resolution **Connector and Integration Management** - Monitor, troubleshoot, and resolve issues with SOAR connectors and system integrations. - Ensure seamless and continuous data exchange between SOAR and all integrated security solutions (e.g., SIEM, EDR, firewall, threat intel, ticketing). **Backup and Configuration Management** - Perform monthly backups of SOAR: - Playbooks - Configuration data - System settings and alerts - Agent and SME nodes **Vendor Coordination** - Act as the primary point of contact with Fortinet for: - Issue escalation and troubleshooting - Platform patches and upgrades - Enhancement requests and license tracking - Track and close vendor support tickets in accordance with SLA timelines. **Platform Health and Optimization** - Conduct quarterly health checks to assess: - System performance and load handling - Integration health and response accuracy - Use case effectiveness - Recommend and implement enhancements to improve operational efficiency and incident response timelines. **Access Management and Governance** - Manage user roles, permissions, and platform access control. - Conduct quarterly access reviews to ensure RBAC enforcement and privilege hygiene. **SOP Documentation and Knowledge Base** - Document, maintain, and regularly update: - Standard Operating Procedures (SOPs) - Playbook logic flows - Integration procedures and manual override guidelines **Performance Reporting** - Provide periodic performance reports including: - Playbook execution metrics - Manual vs. automated response ratios - Integration status - SOC efficiency improvements via automation **Integration with Security Ecosystem** - Integrate SOAR with: - SIEM platforms - Threat intelligence sources - Incident ticketing tools - Identity and access management platforms - Maintain alignment with MAF?s overall security architecture. **Incident Response Support and Manual Decisioning** - Support manual approval/denial workflows within playbooks (e.g., approval to block IOCs, isolate assets, trigger escalations). - Ensure proper documentation and SLA adherence for manual interventions. **Playbook Development and Expansion** - Create, update, and maintain playbooks to: - Automate routine tasks (e.g., IOC enrichment, phishing triage) - Enhance response accuracy and consistency - Reduce mean time to respond (MTTR) - Bidders must demonstrate their capability to expand SOAR use cases to drive operational maturity and incident handling speed. **New Connector Development** - Develop and deploy new connectors as needed to support integration with: - New applications - Infrastructure services - Cloud and third-party APIs - Ensure connectors are tested, documented, and production ready. **Business Continuity and Disaster Recovery** - Develop, maintain, and test BC/DR plans for SOAR platform components, agents, and database. - Validate system recovery processes and resilience against platform failure. SOAR Concept